WordPress Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin <= 5.6.9 - Unauthenticated Insecure Direct Object Reference to Sensitive Information Disclosure vulnerability

Unauthenticated Insecure Direct Object Reference to Sensitive Information Disclosure vulnerability discovered by Sorra in WordPress Plugin LatePoint versions = 5.6.9...

EUVD-2026-81417

A flaw was found in the foremanansible plugin's Ansible override values API. The destroy action resolves the target LookupValue record by ID without verifying it belongs to an AnsibleVariable the caller is authorized to edit. An authenticated user with the editansiblevariables permission can dele...

CVE-2026-87829

The Checkout Field Manager Checkout Manager for WooCommerce WordPress plugin before 7.9.7 does not properly validate the ownership of an attachment before deleting it, allowing any authenticated user such as a customer to delete arbitrary media attachments belonging to other users...

CVE-2026-66575: Authorization Bypass Through User-Controlled Key

Unauthenticated Insecure Direct Object References IDOR in King Addons for Elementor = 51.1.81 versions...

CVE-2026-54671: Authorization Bypass Through User-Controlled Key

WeGIA is a web manager for charitable institutions. Prior to 3.8.5, WeGIA maps InternoControle to an empty resource array in web/controle/control.php, and verificarPermissao in web/dao/MiddlewareDAO.php treats that empty array as unconditional access for every authenticated user. The methods in...

PT-2026-95178

Name of the Vulnerable Software and Affected Versions LatePoint | Calendar & Scheduling for WordPress versions prior to 5.7.0 Description An Insecure Direct Object Reference IDOR exists in the set customer object function due to missing validation on a user-controlled key. This allows...

PT-2026-94280

Contributor Insecure Direct Object References IDOR in Cooked = 1.16.0 versions...

PT-2026-95148

Name of the Vulnerable Software and Affected Versions AI Agent Automation versions prior to 0.9.1 Description An issue exists in the backend/src/controllers/memory.controller.js file where requests are authenticated, but the listMemories, deleteMemory, and clearAgentMemory functions fail to verif...

CVE-2026-73999: Authorization Bypass Through User-Controlled Key

Contributor Insecure Direct Object References IDOR in Cooked = 1.16.0 versions...

PT-2026-94262

Unauthenticated Insecure Direct Object References IDOR in King Addons for Elementor = 51.1.81 versions...

CVE-2026-61596

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, djust's per-object authorization getobject + hasobjectpermission, ADR-017 was enforced on the WebSocket mount and event paths but not on three other render entry...

CVE-2026-61596 djust has broken object-level access control (IDOR)

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, djust's per-object authorization getobject + hasobjectpermission, ADR-017 was enforced on the WebSocket mount and event paths but not on three other render entry...

EUVD-2026-81305

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, djust's per-object authorization getobject + hasobjectpermission, ADR-017 was enforced on the WebSocket mount and event paths but not on three other render entry...

CVE-2026-61596

djust , a Django library providing Phoenix LiveView-style reactive server-side rendering with Rust-powered performance, had a broken object-level access control (IDOR) flaw prior to version 1.0.7 . Per-object authorization (get_object + has_object_permission) was enforced on WebSocket mount and e...

CVE-2026-61596 djust has broken object-level access control (IDOR)

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, djust's per-object authorization getobject + hasobjectpermission, ADR-017 was enforced on the WebSocket mount and event paths but not on three other render entry...

CVE-2026-61596

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, djust's per-object authorization "getobject" + "hasobjectpermission", ADR-017 was enforced on the WebSocket mount and event paths but not on three other render...

CVE-2026-61596 djust has broken object-level access control (IDOR)

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, djust's per-object authorization getobject + hasobjectpermission, ADR-017 was enforced on the WebSocket mount and event paths but not on three other render entry...

GHSA-C7C5-5J6R-Q957 djust has broken object-level access control (IDOR)

Impact djust's per-object authorization getobject + hasobjectpermission, ADR-017 was enforced on the WebSocket mount and event paths but not on three other render entry points: a the initial HTTP GET render, b SPA urlchange navigation, and c % liverender % embedded child views. An authenticated...

djust has broken object-level access control (IDOR)

Impact djust's per-object authorization getobject + hasobjectpermission, ADR-017 was enforced on the WebSocket mount and event paths but not on three other render entry points: a the initial HTTP GET render, b SPA urlchange navigation, and c % liverender % embedded child views. An authenticated...

CVE-2026-92765

ArcherySec through 2.0.6 fails to validate organization ownership in the WebScanVulnList endpoint, allowing authenticated users to read vulnerability findings from other organizations. Attackers can supply arbitrary scan identifiers to retrieve complete web vulnerability data including titles,...